fix(fetch,git): bump minimum mcp version to 1.23.0 for security fixes

[glatinone]

Summary

src/fetch/pyproject.toml and src/git/pyproject.toml pin only a lower bound on the mcp SDK dependency (mcp>=1.1.3 and mcp>=1.0.0 respectively), which allows dependency resolution to land on versions vulnerable to CVE-2025-66416.

CVE-2025-66416

Affected mcp SDK versions (< 1.23.0) do not enable DNS-rebinding protection by default for localhost HTTP servers, and the same release also fixes CVE-2025-53366 (a malformed-request DoS). Both mcp-server-fetch and mcp-server-git run as local MCP servers that can be exposed via HTTP transport, so both are in the affected surface.

Fix

Bump the minimum mcp version to 1.23.0 in both pyproject.toml files — a pure two-line version-floor change, no other files touched:

- "mcp>=1.1.3",
+ "mcp>=1.23.0",

- "mcp>=1.0.0",
+ "mcp>=1.23.0",

Test plan

• CI dependency resolution / build passes for src/fetch and src/git with the new floor
• No behavioral changes expected — this only raises the minimum resolvable SDK version

[olaservo]

Thank you for the PR! This was superseded by #4663, released as 2026.8.18. You were right that the floor needed raising, but 1.23.0 is still inside the ranges for GHSA-jpw9-pfvf-9f58 (<=1.27.1) and GHSA-hvrp-rf83-w775 (>=1.23.0, <=1.27.1), and without an upper bound uvx still resolved 2.0.0 and failed at import. The merged change sets mcp>=1.29.0,<2 — 1.29.0 is the last 1.x release and clears all three advisories. Closing as superseded.